RUNDLL32.ORGhttp://www.rundll32.org/RainbowSoft Studio Z-Blog 1.8 Spirit Build 80722zh-CNCopyright RUNDLL32.ORG. Some Rights Reserved.Fri, 12 Jun 2009 13:46:12 +0800Analysis of the Green Dam Censorware Systema@b.com (rundll32)http://www.rundll32.org/post/296.htmlFri, 12 Jun 2009 13:44:23 +0800http://www.rundll32.org/post/296.htmlSummary    We have discovered remotely-exploitable vulnerabilities in Green Dam, the censorship software reportedly mandated by the Chinese government. Any web site a Green Dam user visits can take control of the PC.

...]]>Thumbshttp://www.rundll32.org/post/296.html#commenthttp://www.rundll32.org/http://www.rundll32.org/feed.asp?cmt=296http://www.rundll32.org/cmd.asp?act=tb&id=296&key=efba53ddMicrosoft Sets Record With Monster Patch Tuesday a@b.com (rundll32)http://www.rundll32.org/post/295.htmlFri, 12 Jun 2009 08:17:35 +0800http://www.rundll32.org/post/295.htmlMicrosoft today issued 10 security updates that patched a record 31 vulnerabilities in Windows, Internet Explorer, Excel, Word, Windows Search and other programs, including 18 bugs marked 'critical.' Of the 10 bulletins, six patched some part of Windows, while three patched an Office application or component, and one fixed a flaw in IE. The total bug count was the most patched by Microsoft in a single month since the company began regularly scheduled updates in 2003. The previous record of 26 vulnerabilities patched occurred in both August 2008 and August 2006. 'This is a very broad bunch,' said Wolfgang Kandek, CTO at Qualys, 'compared to last month, which was really all about PowerPoint. You've got to work everywhere, servers and workstations, and even Macs if you have them. It's not getting any better, the number of vulnerabilities [Microsoft discloses] continues to grow.

...]]>Dynamichttp://www.rundll32.org/post/295.html#commenthttp://www.rundll32.org/http://www.rundll32.org/feed.asp?cmt=295http://www.rundll32.org/cmd.asp?act=tb&id=295&key=5ecf4cd2Green Dam-Youth Escorta@b.com (rundll32)http://www.rundll32.org/post/294.htmlThu, 11 Jun 2009 09:55:55 +0800http://www.rundll32.org/post/294.html"Green Dam" utilizes the Winsock2 SPI port to obtain data from both sender and recipient, and through analyzing these data, obtains http data. Having obtained http data protocol and run through a URL detector, a harmful URL detector and a keyword detector, Green Dam decides based on those results whether or not image detection is needed, and through image detection, addresses of websites containing harmful information are delivered to system management.]]>Thumbshttp://www.rundll32.org/post/294.html#commenthttp://www.rundll32.org/http://www.rundll32.org/feed.asp?cmt=294http://www.rundll32.org/cmd.asp?act=tb&id=294&key=db6f167dWhat's the suspicious Rundll32.exe processa@b.com (rundll32)http://www.rundll32.org/post/293.htmlWed, 13 May 2009 12:04:11 +0800http://www.rundll32.org/post/293.htmlWhen you open Task Manager, you may see Rundll32.exe entry in the Processes tab. Or, you may also encounter a rundll32.exe error at shutdown. Rundll32.exe is a valid system file which executes a DLL. The actual command may be Rundll32.exe filename.xxx, <function>, whereas Task Manager reports only the command name and not it's parameter.

...]]>Thumbshttp://www.rundll32.org/post/293.html#commenthttp://www.rundll32.org/http://www.rundll32.org/feed.asp?cmt=293http://www.rundll32.org/cmd.asp?act=tb&id=293&key=5a9e6e0bHow Rundll Worksa@b.com (rundll32)http://www.rundll32.org/post/292.htmlFri, 08 May 2009 11:21:33 +0800http://www.rundll32.org/post/292.htmlHow Rundll Works

Rundll performs the following steps:

  1. It parses the command line.
  2. It loads the specified DLL via LoadLibrary().
    3. ...]]>Thumbshttp://www.rundll32.org/post/292.html#commenthttp://www.rundll32.org/http://www.rundll32.org/feed.asp?cmt=292http://www.rundll32.org/cmd.asp?act=tb&id=292&key=3060e98cDetermining which modules are being executed by Rundll.32.exea@b.com (rundll32)http://www.rundll32.org/post/291.htmlWed, 15 Apr 2009 08:15:50 +0800http://www.rundll32.org/post/291.htmlThe Windows XP tool Tasklist can be used to determine what program modules are currently being executed by rundll32.exe. (For discussion of Tasklist, go to this page.) To create a list of running tasks, open a Command Prompt window and enter the following command:

    ...]]>    Thumbshttp://www.rundll32.org/post/291.html#commenthttp://www.rundll32.org/http://www.rundll32.org/feed.asp?cmt=291http://www.rundll32.org/cmd.asp?act=tb&id=291&key=be2a8a23    Microsoft reaches RC Milestone with Windows 7 Build 7105a@b.com (rundll32)http://www.rundll32.org/post/290.htmlWed, 08 Apr 2009 14:04:27 +0800http://www.rundll32.org/post/290.htmlBuild numbers have been flying around like crazy as usual but Windows 7 Build 7105 has had many fans scratching their heads over. According to Neowin, Build 7105 is an RC build. The build string is  6.1.7105.0.090404-1235_x86fre_client_en-us_Retail_Ultimate-GB1CULFRER_EN_DVD and the build was compiled on April 4th. According to some screenshots Faikee found, this may very well be the case. The following screenshot was found by Faikee from our forums:

    ...]]>    Thumbshttp://www.rundll32.org/post/290.html#commenthttp://www.rundll32.org/http://www.rundll32.org/feed.asp?cmt=290http://www.rundll32.org/cmd.asp?act=tb&id=290&key=3917f76d    Taming Confickera@b.com (rundll32)http://www.rundll32.org/post/289.htmlWed, 01 Apr 2009 08:08:40 +0800http://www.rundll32.org/post/289.htmlConficker virus could be deadly threat – or April Fool's joke

    Virus that has infected 10m computers leaves experts baffled.It could be the biggest April Fool's joke ever played on the internet, or it could be one of the worst days ever for computers connected to the network. Security experts can't work out whether the Conficker virus – which has infected more than 10m Windows PCs worldwide – will wreak havoc on Wednesday , or just let the day pass quietly.

    ...]]>    Thumbshttp://www.rundll32.org/post/289.html#commenthttp://www.rundll32.org/http://www.rundll32.org/feed.asp?cmt=289http://www.rundll32.org/cmd.asp?act=tb&id=289&key=ee2193f5    Windows Rundll and Rundll32 Interfacea@b.com (rundll32)http://www.rundll32.org/post/288.htmlMon, 30 Mar 2009 12:56:21 +0800http://www.rundll32.org/post/288.htmlRundll vs. Rundll32

    Rundll loads and runs 16-bit DLLs, whereas Rundll32 loads and runs 32-bit DLLs. If you pass the wrong type of DLL to Rundll or Rundll32, it may fail to run without indicating any error messages.

    ...]]>    Thumbshttp://www.rundll32.org/post/288.html#commenthttp://www.rundll32.org/http://www.rundll32.org/feed.asp?cmt=288http://www.rundll32.org/cmd.asp?act=tb&id=288&key=477082ba    Mimivirusa@b.com (rundll32)http://www.rundll32.org/post/287.htmlWed, 25 Mar 2009 10:38:31 +0800http://www.rundll32.org/post/287.htmlMimivirus is one of the largest and most complex viruses known. The virus was first isolated in 1992 from amoebae growing in a water tower in Bradford. La Scola, B. et al. (2003) A giant virus in amoebae. Science 299: 2033.

    ...]]>    Thumbshttp://www.rundll32.org/post/287.html#commenthttp://www.rundll32.org/http://www.rundll32.org/feed.asp?cmt=287http://www.rundll32.org/cmd.asp?act=tb&id=287&key=81698d23